harness-everything 0.20.7 → 0.21.0

package/plugins/harness-everything/skills/harness-everything/scripts/system-one/provider.js

@@ -0,0 +1,76 @@
+'use strict';
+const fs = require('node:fs');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const { validateRequest } = require('./contract');
+// Upstream cua_s1 source revision documented in docs/system-one-routing.md.
+const PINNED_CUA_S1_REVISION = 'b7f7e2d8714609853a29c7d049140bc46aec0954';
+const ADAPTER = path.join(__dirname, 'cua_adapter.py');
+const unavailable = reason => ({ status: 'unavailable', reason });
+const exact = (value, keys) => value && typeof value === 'object' && !Array.isArray(value)
+  && Object.keys(value).length === keys.length && keys.every(k => Object.hasOwn(value, k));
+const label = value => typeof value === 'string' && value.length > 0 && value.length <= 128 && !/[\u0000-\u001f]/.test(value);
+function validateManifest(m) {
+  const required = ['schemaVersion', 'python', 'checkpoint', 'weightsSha256', 'configSha256', 'modelId', 'revision', 'domain'];
+  if (!m || typeof m !== 'object' || Array.isArray(m) || required.some(k => !Object.hasOwn(m, k))
+    || Object.keys(m).some(k => ![...required, 'timeoutMs'].includes(k)) || m.schemaVersion !== 1
+    || ['python', 'modelId', 'revision', 'domain'].some(k => typeof m[k] !== 'string' || !m[k].trim() || m[k].length > 4096 || m[k].includes('\0'))
+    || typeof m.checkpoint !== 'string' || !path.isAbsolute(m.checkpoint) || path.extname(m.checkpoint) !== '.safetensors'
+    || ['weightsSha256', 'configSha256'].some(k => typeof m[k] !== 'string' || !/^[a-f0-9]{64}$/.test(m[k]))
+    || (m.timeoutMs !== undefined && (!Number.isInteger(m.timeoutMs) || m.timeoutMs < 1 || m.timeoutMs > 10000))
+    || (m.modelId === 'cua-ai/cua-s1-forms' && m.domain !== 'forms-v1')) throw new TypeError('invalid-manifest');
+  return true;
+}
+function readManifest(manifestPath) {
+  if (typeof manifestPath !== 'string' || !path.isAbsolute(manifestPath) || fs.statSync(manifestPath).size > 65536) throw new Error();
+  const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+  validateManifest(manifest);
+  return manifest;
+}
+function spawnJson(executable, args, input, timeoutMs) {
+  let result;
+  try {
+    result = spawnSync(executable, args, { input, encoding: 'utf8', shell: false,
+      timeout: timeoutMs, killSignal: 'SIGKILL', maxBuffer: 1024 * 1024, windowsHide: true });
+  } catch (_) { return unavailable('provider-unavailable'); }
+  if (result.error) return unavailable(result.error.code === 'ETIMEDOUT' ? 'provider-timeout'
+    : result.error.code === 'ENOBUFS' ? 'provider-output-limit' : 'provider-unavailable');
+  if (result.status !== 0) return unavailable('provider-exit');
+  try { return { status: 'ok', value: JSON.parse(result.stdout) }; }
+  catch (_) { return unavailable('provider-json'); }
+}
+function runProvider(request, executable, args, timeoutMs = 2000) {
+  validateRequest(request);
+  const result = spawnJson(executable, args, JSON.stringify(request), timeoutMs);
+  return result.status === 'ok' ? { status: 'scored', response: result.value } : result;
+}
+function score(request, manifestPath) {
+  validateRequest(request);
+  let manifest;
+  try { manifest = readManifest(manifestPath); } catch (_) { return unavailable('provider-config'); }
+  // Send the exact validated manifest to the child on stdin: no config reread race.
+  return runProvider({ ...request }, manifest.python, [ADAPTER, JSON.stringify(manifest)], manifest.timeoutMs || 2000);
+}
+// The probe reports what is installed; only a PEP 610 VCS commit counts as a source revision.
+function validateProvenance(p) {
+  if (!exact(p, ['schemaVersion', 'python', 'cuaS1', 'torch']) || p.schemaVersion !== 1
+    || !exact(p.python, ['implementation', 'version']) || !label(p.python.implementation) || !label(p.python.version)
+    || !exact(p.cuaS1, ['distribution', 'version', 'sourceRevision'])
+    || ![p.cuaS1.distribution, p.cuaS1.version, p.torch].every(v => v === null || label(v))
+    || (p.cuaS1.sourceRevision !== null && !(typeof p.cuaS1.sourceRevision === 'string' && /^[0-9a-f]{40}$/.test(p.cuaS1.sourceRevision)))) {
+    throw new TypeError('invalid-provenance');
+  }
+  const revision = p.cuaS1.sourceRevision;
+  return { python: { ...p.python }, torch: p.torch, cuaS1: { ...p.cuaS1, pinnedRevision: PINNED_CUA_S1_REVISION,
+    sourceRevisionStatus: revision === null ? 'unavailable' : revision === PINNED_CUA_S1_REVISION ? 'pinned' : 'mismatch' } };
+}
+function provenance(manifestPath) {
+  let manifest;
+  try { manifest = readManifest(manifestPath); } catch (_) { return unavailable('provider-config'); }
+  // Metadata scans can exceed the per-score budget; use the manifest cap. No model is loaded.
+  const result = spawnJson(manifest.python, [ADAPTER, '--provenance'], '', 10000);
+  if (result.status !== 'ok') return result;
+  try { return { status: 'recorded', provenance: validateProvenance(result.value) }; }
+  catch (_) { return unavailable('provider-json'); }
+}
+module.exports = { score, runProvider, validateManifest, provenance, validateProvenance, PINNED_CUA_S1_REVISION };

package/plugins/harness-everything/skills/harness-everything/scripts/system-one/router.js

@@ -0,0 +1,37 @@
+'use strict';
+const { createRequest, decide } = require('./contract');
+const provider = require('./provider');
+const TIER_OPTIONS = Object.freeze([
+  { id: 'tier1', text: 'A small bounded edit or operation with clear scope.' },
+  { id: 'tier2', text: 'Implementation or bug fix needing iterative testing.' },
+  { id: 'tier3', text: 'Architecture, repository-wide change or multi-stage engineering.' },
+  { id: 'unclassified', text: 'Unclear intent, insufficient context or outside these categories.' },
+].map(Object.freeze));
+const LABELS = { tier1: 'Tier 1 (Trivial)', tier2: 'Tier 2 (Standard Task)', tier3: 'Tier 3 (Macro Task)' };
+const RANK = { tier1: 1, tier2: 2, tier3: 3 };
+// input.floor is the deterministic structural minimum; a scorer may raise the tier, never lower it below the floor.
+function selectTier(input, env = process.env, scorer = provider.score) {
+  const mode = env.HARNESS_SYSTEM_ONE_MODE || 'off';
+  if (mode === 'off') return { tier: input.tier, diagnostic: null };
+  const fallback = (reason, status = 'unavailable') => ({ tier: input.tier, diagnostic: { mode: ['shadow', 'prefer'].includes(mode) ? mode : 'invalid', status, reason } });
+  if (!['shadow', 'prefer'].includes(mode)) return fallback('invalid-mode');
+  if (input.floor != null && !Object.hasOwn(RANK, input.floor)) return fallback('invalid-request');
+  let request;
+  try { request = createRequest('tier', input.prompt, TIER_OPTIONS); }
+  catch (_) { return fallback('invalid-request'); }
+  let result;
+  try { result = scorer(request, env.HARNESS_SYSTEM_ONE_CONFIG); }
+  catch (_) { return fallback('provider-unavailable'); }
+  if (!result || result.status !== 'scored') {
+    const allowed = ['provider-timeout', 'provider-output-limit', 'provider-exit', 'provider-json', 'provider-config', 'provider-unavailable'];
+    return fallback(allowed.includes(result?.reason) ? result.reason : 'provider-unavailable');
+  }
+  const decision = decide(request, result.response);
+  if (decision.selectedId === 'unclassified') Object.assign(decision, { selectedId: null, status: 'abstain', reason: 'unclassified' });
+  const accepted = decision.status === 'accepted';
+  const belowFloor = accepted && input.floor != null && RANK[decision.selectedId] < RANK[input.floor];
+  const applied = mode === 'prefer' && accepted && !input.explicit && !belowFloor;
+  const reason = input.explicit && accepted ? 'explicit-precedence' : belowFloor ? 'structural-floor' : decision.reason;
+  return { tier: applied ? LABELS[decision.selectedId] : input.tier, diagnostic: { mode, ...decision, applied, reason } };
+}
+module.exports = { selectTier, TIER_OPTIONS };

package/plugins/harness-everything/skills/harness-everything/scripts/tier-router.js

@@ -313,6 +313,19 @@ function run(userPrompt, context) {
     }
   }
 
+  const { selectTier } = require('./system-one/router');
+  const structuralFloor = hasMacroSignal ? 'tier3'
+    : !isTrivialDocsEdit && hasMultipleTasks && hasMultipleSentences ? 'tier2' : null;
+  const semantic = selectTier({ prompt: userPrompt, tier: recommendedTier, floor: structuralFloor,
+    explicit: Boolean(detectExplicitStrategy(userPrompt, detectFableModel(userPrompt))) });
+  if (semantic.diagnostic) console.log(`\n=> SYSTEM ONE: ${JSON.stringify(semantic.diagnostic)}`);
+  if (semantic.diagnostic?.applied) {
+    recommendedTier = semantic.tier;
+    rationale = 'System One selected a tier from the fixed catalog; deterministic policy remains authoritative.';
+    reasonCodes.splice(loadedConfig.reasonCodes.length);
+    addReason(reasonCodes, 'system-one-tier');
+  }
+
   console.log(`\n=> RECOMMENDED TIER: ${recommendedTier}`);
   console.log(`=> RATIONALE: ${rationale}`);
 
@@ -447,6 +460,7 @@ function run(userPrompt, context) {
   return contract;
 }
 
+if (require.main === module) {
 let userPrompt = process.argv[2] || '';
 let hookContext = null;
 
@@ -471,3 +485,5 @@ if (process.argv[2]) {
     run(userPrompt, hookContext);
   });
 }
+}
+module.exports = { run };

package/sbom.cdx.json

@@ -2,23 +2,23 @@
   "$schema": "https://cyclonedx.org/schema/bom-1.7.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.7",
-  "serialNumber": "urn:uuid:12ceeeac-7f99-5fb2-82a3-768d5d708e00",
+  "serialNumber": "urn:uuid:8d95a5fe-dcbc-5aa9-8dc9-f8d6eae221da",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-22T16:17:00.105Z",
+    "timestamp": "2026-09-23T03:35:45.203Z",
     "tools": [
       {
         "vendor": "Harness Everything",
         "name": "generate-sbom.js",
-        "version": "0.20.7"
+        "version": "0.21.0"
       }
     ],
     "component": {
       "type": "application",
-      "bom-ref": "pkg:npm/harness-everything@0.20.7",
+      "bom-ref": "pkg:npm/harness-everything@0.21.0",
       "name": "harness-everything",
-      "version": "0.20.7",
-      "purl": "pkg:npm/harness-everything@0.20.7"
+      "version": "0.21.0",
+      "purl": "pkg:npm/harness-everything@0.21.0"
     }
   },
   "components": [
@@ -1999,7 +1999,7 @@
       ]
     },
     {
-      "ref": "pkg:npm/harness-everything@0.20.7",
+      "ref": "pkg:npm/harness-everything@0.21.0",
       "dependsOn": [
         "pkg:npm/%40commitlint/cli@19.8.1",
         "pkg:npm/%40commitlint/config-conventional@19.8.1",

package/scripts/evaluate-system-one.js

@@ -0,0 +1,57 @@
+#!/usr/bin/env node
+'use strict';
+const fs = require('node:fs');
+const os = require('node:os');
+const { performance } = require('node:perf_hooks');
+const { validateCorpus, evaluate } = require('../harness-everything/scripts/system-one/evaluate');
+const { score, provenance } = require('../harness-everything/scripts/system-one/provider');
+const { decide } = require('../harness-everything/scripts/system-one/contract');
+const { run: route } = require('../harness-everything/scripts/tier-router');
+
+function run(corpus, manifest) {
+  validateCorpus(corpus);
+  const records = [];
+  const originalMode = process.env.HARNESS_SYSTEM_ONE_MODE;
+  const originalLog = console.log;
+  try {
+    process.env.HARNESS_SYSTEM_ONE_MODE = 'off';
+    console.log = () => {};
+    for (const c of corpus.cases.filter(item => item.split === 'holdout')) {
+      const tier = route(c.request.context).workflowPlan.tier;
+      const runs = [];
+      for (let i = 0; i < 2; i++) {
+        const start = performance.now();
+        const result = score(c.request, manifest);
+        const decision = result.status === 'scored' ? decide(c.request, result.response) : result;
+        if (decision.selectedId === 'unclassified') Object.assign(decision, { status: 'abstain', reason: 'unclassified', selectedId: null });
+        const scores = ['accepted', 'abstain'].includes(decision.status) ? result.response.scores.map(s => s.probability) : null;
+        runs.push({ decision, scores, latencyMs: performance.now() - start, coldStart: true });
+      }
+      records.push({ id: c.id, baseline: tier === 'unclassified' ? null : tier, runs });
+    }
+  } finally {
+    console.log = originalLog;
+    if (originalMode === undefined) delete process.env.HARNESS_SYSTEM_ONE_MODE;
+    else process.env.HARNESS_SYSTEM_ONE_MODE = originalMode;
+  }
+  let artifact = null;
+  try {
+    const m = JSON.parse(fs.readFileSync(manifest, 'utf8'));
+    artifact = { declaredModelId: m.modelId, declaredRevision: m.revision, weightsSha256: m.weightsSha256, configSha256: m.configSha256 };
+  } catch (_) { /* Missing provider remains an explicit unavailable measurement. */ }
+  const source = provenance(manifest);
+  return { ...evaluate(corpus, records, source), evidence: { kind: 'offline-one-shot', artifact, source,
+    environment: { cpu: os.cpus()[0]?.model || 'unknown', os: `${os.platform()} ${os.release()} ${os.arch()}`, node: process.version,
+      python: source.status === 'recorded' ? source.provenance.python : null, threads: 1 },
+    limitations: ['No independently verified holdout review', 'No warm inference measurement', 'No live-host or policy evidence'] }, records };
+}
+if (require.main === module) {
+  try {
+    const [input, manifest, output, extra] = process.argv.slice(2);
+    if (!input || !manifest || !output || extra) throw new Error('usage');
+    const report = run(JSON.parse(fs.readFileSync(input, 'utf8')), manifest);
+    fs.writeFileSync(output, JSON.stringify(report, null, 2) + '\n');
+    console.log(JSON.stringify({ cases: report.cases, coverage: report.model.coverage, rolloutReady: report.rolloutReady }));
+  } catch (_) { console.error('System One evaluation failed: invalid corpus, arguments, or output path.'); process.exitCode = 1; }
+}
+module.exports = { run };